2014 Alexandrina Council Business Continuity Plan · Alexandrina Council Business Continuity Plan Prepared by LGRS ... A key objective of the BCP is to increase the awareness within

C:\Users\annel\AppData\Local\Temp\190116 Alexandrina Business Continuity Overarching Plan_C50D30.docx Page 1

Alexandrina CouncilBusiness Continuity Plan

Prepared by LGRS – Risk Management

Issue: Four Issue Date: 19 January 2016

1

Table of ContentsDocument Review ....................................................................................................................................3

Abbreviations and Definitions...................................................................................................................4

Introduction ...............................................................................................................................................5Purpose.................................................................................................................................................5Objectives .............................................................................................................................................5Use of the BCP .....................................................................................................................................5Assumptions..........................................................................................................................................6Limitations .............................................................................................................................................6Audience – Distribution .........................................................................................................................6Authority ................................................................................................................................................6Training and Communication................................................................................................................6Validation and Testing ..........................................................................................................................7Monitoring & review ..............................................................................................................................7Overview of Business Function Criticality.............................................................................................7Scope ....................................................................................................................................................9

Methodology ...........................................................................................................................................10

Continuity Management Team ...............................................................................................................12Roles and Responsibilities CMT.........................................................................................................12CMT – Structure..................................................................................................................................12

Notification – Declaration Process .........................................................................................................14Notification ..........................................................................................................................................14Assessment.........................................................................................................................................14Declaration ..........................................................................................................................................14Control Centre.....................................................................................................................................15Business Impact Analysis (BIA) ..........................................................................................................15Responsibility Statements...................................................................................................................15Business Continuity Instructions (BCI) ...............................................................................................15Emergency Contacts...........................................................................................................................16Initial CMT Meeting .............................................................................................................................16Communications – General ................................................................................................................16Communications – Staff......................................................................................................................17Communications – Community...........................................................................................................17General Statement to Media in the event of a business interruption event........................................17Responsibility Statements...................................................................................................................18

BCI 1 Emergency Contacts Continuity Management Team.............................................................28

BCI 2 Emergency Contacts External ................................................................................................30

BCI 2. Continuity Management Team Meeting Agenda....................................................................31

BCI 3 Staff Business Interruption Alert .............................................................................................32

BCI 4 Media Enquiry Record Form...................................................................................................33

BCI 5 Press Release ........................................................................................................................34

BCI 6 Telephone Redirection Authorisation .....................................................................................35

BCI 7 Business Continuity Coordination Centre Checklist ...............................................................36

BCI 8 Pandemic Response Information Guide.................................................................................38National, State & Local Pandemic Planning Matrix ............................................................................38Phases of Human Influenza Pandemic...............................................................................................39Recommended Actions for Australian Businesses.............................................................................40

BCI 9 Immediate Actions Guide .......................................................................................................42

2

................................................................................................................................................................43

Critical Function Sub Plans ..................................................................................................................44Organisation and Culture ....................................................................................................................45Service Centre – Call Centre............................................................................................................49Customer Service .............................................................................................................................52Engineering and Environment.............................................................................................................58CWMS.................................................................................................................................................59Food Safety Regulations ..................................................................................................................68Environmental Health Emergency Management ...........................................................................71Infrastructure & Assets........................................................................................................................74Information Management – Vital Records ......................................................................................75IT Services – Service Desk...............................................................................................................78IT Services Infrastructure.................................................................................................................80

3

Document ReviewWhenever this document is reviewed and or amended, details must be recorded on this page.

Date Review Summary

16 Jan 2014 Updated for organisation restructure and contact details

14 July 2014 Updated for BCP Maintenance Workshop on 9 July 2014

28 January2015

Updated for BCP Training Exercise on 28 January 2015

14December2015

Updated for BCP Logistical Test Exercise held on 10 December 2015

4

Abbreviations and DefinitionsTerm Definition Abbreviation

Business Continuity Is the uninterrupted availability of all key resources supportingessential business functions.

BC

Business ContinuityControl Centre

A central point of reference to co-ordinate the response to a businessinterruption event. To be established at the discretion of the CMTDirector.

BCCC

Business ContinuityManagement

Provides for the availability of processes and resources in order toensure the continued achievement of critical objectives.

BCM

Business ContinuityPlan(s)

A collection of procedures and information that is developed compiledand maintained in readiness for use in the event of an emergency ordisaster.

BCP

Business ProcessAssessment

A management tool designed to assist in the identification andassessment of criticality of business processes and functions

BPA

Business ImpactAnalysis

A management level analysis which identifies the impacts of functionloss on the organisation. The BIA provides management with dataupon which to base risk mitigation and continuity planning decisions.

BIA

Business InterruptionEvent

An event that by its duration exceeds the Maximum AcceptableOutage and / or has an adverse impact on business objectives andrequires the implementation of the BCP or sub plans.

BIE

Non Critical FunctionAction Plan

An agreed documented course of action that identifies mitigation,response and recovery actions for business functions identified asnon-critical.

Non CriticalFunctionAction Plan

Critical Function SubPlan

An agreed documented course of actions to be taken in the event ofbusiness function loss. Plan describes the key actions required underpreparation, response and recovery phases.

CFSP

ContinuityManagement Team

An assembly of executive management representatives and otherseconded staff formed for the express purpose of responding to anorganisational crisis. CMT management structure will overlay allnormal management structures during the response process.

CMT

Emergency Event An event due to an actual or imminent occurrence (such as a fire,earthquake, or epidemic which:

1. endangers or threatens to endanger the safety or health of staff orvisitors to the organisation

2. destroys or damages, or threatens to destroy or damage, propertyof the organisation

3. Has the capacity to disrupt operations to the extent that it impactson business objectives.

EmergencyEvent

Maximum AcceptableOutage

The maximum period of time that Council can tolerate the loss ofcapability of a critical business function, process, asset or ITapplication.

MAO

Corporate Governance A system by which the organisation is directed and controlled.Corporate Governance activities are represented as four principalcomponents: direction, executive action, supervision andaccountability.

CG

Risk Management The culture, processes and structures that are directed towardsrealising potential opportunities whilst managing adverse effects.

RM

InformationTechnology

The technology involved with the transmission and storage ofinformation, especially the development, installation, implementation,and management of computer systems and telephone systems.

IT

5

IntroductionPurpose

The Alexandrina Council has adopted a comprehensive and integrated approach to the development of aBusiness Continuity Management Plan. The purpose of this plan is to build organisational capabilities tosupport the continued achievements of critical business objectives in the face of uncertainty or disruption.

Council recognises that this plan (Business Continuity Plan) in isolation does not build capability; itprovides the approach to establishing effective capability. Whilst the plan is important, it is an outcome ofthe more important planning and analysis process, and is a blueprint to kick-start the response to abusiness interruption event.

This plan identifies the required facilities, technical infrastructure, key responsibilities, and processes thatwill be required to position Council to be able to respond and recover from a business interruption event.

Objectives

The objectives of the Alexandrina Council’s Business Continuity Framework is to provide a mechanismthat enables Council and its officers to:

Identify business functions that are critical to Council in meeting its business objectives

Develop resumption plans based on criticality of business functions rather than geographic location

Build resilience within Council’s operational framework

Identify and document roles and responsibilities for key staff positions

Minimise the impact of function loss on stakeholders and the community.

The business continuity plan provides a framework for management and staff to enable them toimplement an agreed response process.

In assessing the business continuity risks of the Alexandrina Council it became evident that given thestructure local government a number of inherent advantages were identified such as:

Multiple facilities providing common services reducing the impact of a single facility loss

Common IT systems with duplication and access across most facilities

Ability to transfer staff and tasks to other facilities, and

The ability to call on adjoining Councils for assistance in service delivery.

In the event of a business interruption event, these advantages would suggest the business impact is areduction in capacity rather than a loss of capability in a particular area.

Use of the BCP

This plan should be used in the event of a business interruption event that may impact on the ability of theAlexandrina Council to deliver business objectives. Managers and staff with responsibility for impactedareas of the business should use the BCP and any relevant sub plans to ensure a consistent and agreedcourse of action is implemented.

6

Assumptions

The BCP is intended to provide guidance to Council officers to assist continuity of service for criticalfunctions, where those officers are not normally responsible for managing the specific function affected.Where the Council officer who is normally responsible for managing the specific function is available, it isassumed that this document will serve as a check document to reduce the possibility for omission ofimportant actions.

Limitations

It is not the intent of this document or process to develop Information Technology Disaster RecoveryPlans. (IT DR) This process will however identify from a business perspective the business requirementsfor Information Technology resources that support the delivery of business critical function. Thisinformation should then be used to inform the development of ITDR plans.

Audience – Distribution

The intended audience for the Alexandrina Council Business Continuity Plan is:

Council

Executive Team

Critical Function Sub Plan Managers and Staff

Non Critical Function Action Plan Managers and Staff.

The plan is available to all Managers and staff via Councils intranet and is to be reviewed annually by theexecutive.

Authority

1. The Alexandrina Council Business Continuity Plan has been developed under the authority of themanaging executive. Prior to implementation the plan was reviewed and approved by that body.

2. A standing authority is given to the Sub-Plan owners by the managing executive to implement theactions identified within the sub plans.

Training and Communication

A key objective of the BCP is to increase the awareness within the Alexandrina Council of potentialbusiness interruption events that could impact Council. The plan outlines the response / recoveryprotocols associated with such an event. Training and communication will play a key role in achieving thisobjective.

Initial training has been provided by the process facilitators however one of the benefits of a facilitatedprocess is that engagement and ownership of the BCP is developed at the business unit level. Trainingwas provided to the Senior Management Team as part of the BCP implementation. It will be theresponsibility of the various Senior Managers to ensure that the requirements of the BCP arecommunicated to all staff and that induction / training programs include reference to business continuity inthe context of sound risk management practices.

Managers should be familiar with key deliverables as detailed in the Critical Function Sub Plans andensure that staff are aware of their roles and responsibilities in the event of a business interruption event.

7

Validation and Testing

Business Continuity Management is a process, not an event. Once the BCP has been preparedcommitment to a pre-planned, annual test plan and maintenance schedule is required by Council toensure BCP procedures remain viable into the future.

The testing should include all aspects of the BCP, but not necessarily all in one year. Major components(Sub Plans) should be reviewed at least annually. Volatile information such as contact lists, or areas thatare constantly undergoing changes, should be validated more frequently.

In addition to the annual test and review of the BCP, any significant changes in the Alexandrina Council’soperations should also trigger a review of the BCP. Version control of the BCP should be co-ordinatedthrough the CMT – Coordinator.

Monitoring & review

Monitoring and review is an integral component of the BCP process. Council recognises and iscommitted to ensure the following monitoring and review strategy is implemented.

Activity for Review Accountability Timeframe

1 Business Continuity Plan (overarching plan) Continuity ManagementTeam via the CMTCoordinator

Monitor annually and actionas required

2 Business Continuity Plan Training Continuity ManagementTeam via the CMTCoordinator

Annual training brief orrefresher session

3 Business Continuity Plan Exercise Continuity ManagementTeam via the CMTCoordinator

Annual desk top exercise

Simulation exercise each 2years

Organisational and Culture

4 Critical Function Sub Plans Relevant Manager Annual Review

4a Non Critical Function Action Plans Annual Review

Infrastructure and Assets



Engineering and Environment



Overview of Business Function Criticality

Integral to the BCP is the determination of the Maximum Acceptable Outage (MAO) of a particularbusiness process. The loss of a critical business function for a period greater than the MAO will generally

8

result in the establishment of the Continuity Management Team to direct, oversee and support theemergency, continuity and recovery response phases.

The following table summarise the functions as identified as critical, the maximum acceptable outage forthat function and what Information Technology services are required to facilitate resumption.

Division/Group Organisation & Culture

Business Unit Critical Function Max Acceptable Outage

Human Resources Payroll processing 1-5 Days - shorten

Governance & Strategy Communications / Public Relations 1-2 hours

Library & Customer Service Service Centre – Call Centre 2 hours

Library & Customer Service Customer Service 2 hours

Division/Group Engineering & Environment


CWMS Treatment Plant Operation 4 hours - 2 Weeks

CWMS Pump Station Operation 4 hours - 2 Weeks

CWMS Vacuum Operation 4 hours - 2 Weeks

Roads Road Services 1 – 20 days

Waste Management Waste Collection 2 Days

Environmental Health Food & Safety Regulation 1 day

Environmental Health Environmental Health & EmergencyManagement Activities

1 day

Division/Group Infrastructure & Assets


IT Service Desk Internal 1-14 Days

IT IT Infrastructure Internal 1-14 Days

IT IT advisory – Service Desk 1-14 Days

IT IT advisory – ICT Infrastructure 1-14 Days

IT Information Management Immediate to 2 weeks

9

Scope

The object of the BCP is to ensure that appropriate structures and protocols are in place that enableseffective response to a business interruption event that has the potential to impact on council’s objectives.The BCP documents the processes and resources required by Council in the delivery of its criticalbusiness objectives.

In identifying business continuity risks, the focus is on the building of resilience and response capabilitieswithin business functions that have been identified as critical by the organisation. Treatment options fornon-critical functions are also identified and documented within the framework; this ensures that Councilhas a whole of organisation view when responding to interruption events, as the nature of these eventscan change rapidly.

The BCP does not cover requirements associated with a workplace emergency (safety) situation. Aseparate workplace emergency plan that is the responsibility of the Chief Warden / Emergency Servicesis to be implemented. In all cases of activation of the workplace emergency plan the Chief Warden willbrief the Director of the Continuity Management Team of any implications for business continuity as aresult of the emergency plan activation.

Risk Management Framework

Alexandrina Council

Business ContinuityPlan

Workplace Emergency &Evacuation Plan

Council EmergencyManagement Plan via

I-responda

Organisationand Culture

Engineeringand

Environment

Infrastructure &Assets

CriticalFunction Sub-

plans

Non CriticalFunction Action

Plans


Plans


Plans


plans


plans

IT Disaster Recovery Plan

10

MethodologyBusiness continuity encompasses the identification and risk management of Council’s businessprocesses. It involves a stepping process that seeks to identify, assess control and monitor Council’sbusiness functions. The plan has been developed with consideration given to AS/NZS 5050:2010Business continuity - Managing disruption-related risk, AS/NZS/ISO 3100:2009 Risk Management-Principles and guidelines and the ANAO Business Continuity Management guidelines – “Keep the wheelsin motion”, and Societal Security – Guidelines for incident preparedness and operational continuitymanagement (ISO N022: 2007).

Broadly, the steps in developing the Business Continuity Plan include:

1. Identify and Assess Business Processes and FunctionsIdentify business processes and functions within each individual business unit/section/division. Oncethe functions are identified an analysis at a whole of organisational level is conducted to determinewhich functions are critical and require further planning to ensure the ability to respond in the face ofa continuity interruption event.

2. Conduct the Business Impact Analysis (BIA)The BIA Is conducted on those functions identified as critical within the business processassessment. The BIA is intended to identify the impacts of the function loss on the business includingpenalties for non-delivery, functional interdependencies, organisational ownership, it also looks at theresources currently required to support the functions and assesses the minimum level of resourcesrequired to continue the availability. Importantly the BIA is the tool that is used to determine theMaximum Acceptable Outage (MAO).

3. Critical Function Sub Plan (CFSP) & Non Critical Function Action PlansThe CFSP identifies the agreed actions that a business process owner will undertake to manage theloss of the function through the emergency, continuity and recovery phases. The sub plan identifiesownership, failure scenarios, and criteria for invoking the plan, agreed courses of actions foremergency, continuity and recovery. The CFSP also allows for targeted messages to be developedfor specific function loss.

The Non Critical Function Action Plans are designed to assist the organisation in adopting a riskmanagement approach to the identification, assessment control and monitoring of those businessfunctions determined in the planning phase as non-critical.

4. Overarching Business Continuity Plan (BCP)The BCP identifies the responsibilities of key Managers, with particular emphasis on direction settingand effective and timely communication to stakeholders at an organisational level. It is important torecognise that this document provides a flexible framework in which the organisation can plan fordisruption of its critical functions. It does not attempt to identify and plan for every contingency oroutage that could occur, it provides a flexible framework for the process owners to identify, plan anddevelop redundancy for business processes.

5. Test and maintain the BCPThe BCP will be reviewed annually by the Executive, these actions are essential to ensure that itreflects the current practices of the organisation.

Testing of the Critical Function Sub plans and overarching plans will provide management assurancethat the plan(s) are effective. The testing regime is based on the following:

11

Desktop / paper audit to ensure that the appropriate documents are available and understood; forsub plans and overarching plan

Structured “walk through” where a business interruption scenario is played out through a mockrecovery; and a divisional or whole of organisation level, and

Frequency and actions to be undertaken are identified within the monitoring and review section ofthis document.

12

Continuity Management Team

Roles and Responsibilities CMT

The CMT is established to provide a management mechanism that can ensure reporting lines andresponsibilities are clear when the BCP is activated. The focus of the CMT is to manage the businessinterruption event from a corporate perspective while providing guidance and support to the Managers onsite. This process is facilitated by the development of pre-determined courses of actions (Sub plans) thusallowing the CMT to focus on the strategic or whole of business response to the business interruptionevent. Resilience within the CMT is the responsibility of the CMT. Each position is to have an alternatemember identified and trained in the role.

CMT – Structure

Mayor(Community

engagement)

CMT DirectorChief Executive

CMT MemberEngineering

andEnvironment

CMT MemberPlanning &

Development

CMT MemberLibrary &CustomerService

CMT MemberInformationTechnology

CMT MemberOrganisationand Culture

CMTCoordinator

ManagerGovernance &

Strategy

CMT SupportCMT

CommunicationsOfficer

13

CMT Position Staff Position Alternate Staff Position

CMT Director Chief Executive General Manager Infrastructure &Assets

CMT Member General Manager Engineering andEnvironment

General Manager Infrastructure &Assets

CMT Member Manager IT Services ICT Infrastructure & SecurityCoordinator

CMT Member Manager Planning and Development Manager Infrastructure

CMT Member Manager Library & Customer Service Coordinator, Customer Service

CMT Member General Manager Organisation and Culture Manager Human Resources

CMT Coordinator Manager Governance and Strategy Manager Health, Environment andCommunity Safety

CMTCommunications

Communications Officer Executive Assistant

CMT Support Planning & Development AdministrativeAssistant

Personal Assistant, Organisation &Culture

14

Notification – Declaration ProcessNotification

On first becoming aware of a possible business continuity event, the relevant function manager isrequired to assess the situation and if the event is likely to exceed the agreed “MAO timeframe”, then theCMT Director should be notified immediately by phone and where possible, with a follow-up email orpersonal briefing detailing the key issues including:

Nature of the incident – time informed etc.

Describe business elements impacted (Critical Functions)

Facility / equipment impacted

Staff

Any response actions implemented (Critical Function Sub Plan)

Any media involvement / interest

Any immediate support requirements.

Elements of the BCP (Sub Plans) can be implemented at the local level, where appropriate to address animmediate response requirement even if the event is expected to be resolved within an acceptableperiod.

Assessment

On receipt of a notification that will impact business continuity the CMT Director will:

Formally note details

Notify the other members of the Continuity Management Team (CMT) (consider Telstra conferencecall)

Confirm the details of the incident and appropriate media strategies

Conduct preliminary impact assessment (facility and technology infrastructure)

Determine if a control centre needs to be opened.

Ensure that the Insurer has been formally notified (if appropriate)

Declaration

The CMT Director is to review the preliminary information and if considered necessary declare a BusinessInterruption Event.

The CMT Director is to facilitate the draft communications, both internal and external, for discussion at theinitial CMT meeting.

15

Control Centre

On the declaration of a business interruption event by the Director CMT and if deemed appropriate acontrol centre will be opened. The resourcing and opening of this centre is the responsibility of the CMTcoordinator. Given the variable nature of Business Continuity Events, the following sites have beenidentified and prioritised.

If the incident does not impact on the Alexandrina Council, Administration Building:

1. Council Chambers,

If the Council Chambers is uninhabitable then:

2. Goolwa Depot - meeting room.

3. Strathalbyn Council Office

Business Impact Analysis (BIA)

Central to ensuring the ongoing viability of the business in an interruption event is the identification ofcritical business functions, the processes and assets (people & property) that support the delivery ofthese critical functions and the impact of the loss of the functions on the business are analysed within aBusiness Impact Analysis. BIA’s have been completed for each of the identified critical functions and arecontained within the Critical Function Sub Plans.

Responsibility Statements

Responsibility Statement for each position in the CMT and supporting positions have been developed toensure there are clear and unambiguous directions available for each of the members of the CMT. Allresponsibility statements are to be approved by the CMT and this action is to be recorded on thestatement. On activation of the BCP these statements come into effect.

Business Continuity Instructions (BCI)

Upon declaration of an interruption event the following instructions have been developed to provideassistance. However, any restoration plan developed by the CMT will take precedence over therespective instruction.

Instruction Title

Emergency Contacts

CMT Sample Meeting Agenda

Staff Business Interruption Alert

Media Enquiry Record Form

Press Release

Telephone Redirection Authorisation

Business Continuity Coordination Centre Checklist

Pandemic Response Information Guide

16

Emergency Contacts

A list of Emergency Contacts has been prepared including all nominated members of the CMT, theirdesignated deputies as well as key external services.

A copy of this listing should be held off premises by respective CMT & members and identified alternatesto enable the listing to be referenced in the event that access is denied to the premises.

Initial CMT Meeting

The CMT Director is to call the initial CMT meeting to obtain more detailed information from the relevantbusiness areas impacted, including:

Staff

Any associated Emergency Services issues

Building facilities

Public relations/media

Damage/security, and

Salvage of building and/or IT equipment.

Salvage of records

Review and conformation of delegation of authorities for staff.

Ensure all team members understand their responsibilities and their assigned tasks.

During the meeting information will have been gathered by the various CMT members to produce anevaluation of the incident. A formal record of the meeting to be collated by CMT Support person withparticular emphasis on items to be actioned. This record needs to be regularly reviewed and updated asadditional information comes to hand.

The CMT Director to manage the restoration of business activities in line with the responsibilities definedin the BCP.

Communications - General

All communications will be coordinated through the Continuity Management Team

Due to the nature of the media, the timeliness of reporting in these circumstances is critical. Promptreporting to, and liaison with the Continuity Management Team is in the best interests in terms of allowingfor the preparation of an appropriate response.

The CE will develop the communications strategy that enables for:

News releases to the media Communications between council and the emergency management control agencies Communications to staff Communication to contractors and other external contractors

17

It is Alexandrina Council’s policy that no person other than the Chief Executive Officer (or delegatedGeneral Manager) and/or Mayor divulges any information to the media. This extends to contractors andother service providers and agencies and should be communicated in any site contractor agreements.

In the initial stages of an event the Continuity Management Team will schedule briefings at a designatedlocation. The Continuity Management Team will determine who will attend these meetings and if themeetings are in part or entirely, open to the media, members of the public and staff. Timing andfrequency of the briefing meetings will be matched to severity of the event.

Communications - Staff

In the event of a business interruption event which significantly impacts on the service delivery of Councilservices a staff message will be communicated by email, sms or UHF radio broadcast (BCI 3). Thismessage should be initiated as soon as possible to avoid high volume of traffic on the network regardingdetails of the event. A more formal staff briefing by the Chief Executive Officer, should be undertakenfollowing the Initial Meeting of the continuity Management Team.

Communications - Community

Alexandrina Council Communications Officer will be responsible for the delivery of communications andmedia actions on advice from the Continuity Management Team. The Communications Officer will:

Provide a focal point for media releases and statements to the media Schedule requests for media interviews with the Chief Executive Officer or Mayor Manage the operations and logistics of the media briefings, including time, location, facilities,

content and expectations Monitor and respond to rumours regarding the Council response and continuity management

actions Ensure staff are adequately informed

General Statement to Media in the event of a business interruption event

In the event of a major incident, particularly after-hours, there may be a period of time elapsed before thedesignated media spokesperson is in a position to respond to media enquiries. Should any staff memberbe approached by media representatives for a comment they are only authorised to make the followingstatement:

"I am sorry, but I am not authorised to make any statement at this time. The appropriatepersonnel are currently being briefed on the situation and a spokesperson will beavailable to talk to you shortly”

There is no such thing as an “off the record” comment.

If you cannot immediately refer the journalist to the CE, please complete the Media Enquiry Record Form.

Let the journalist know that someone will return their call promptly.

Provide the Manager Media and Communications with the journalist’s details as soon as possible. Alsoprovide any background and relevant information that you have about the event, including how thejournalist came to contact you.

18

Responsibility Statements

19

Responsibility Statement – CMT Director

Position CMT Director Staff Position Chief Executive

During absence this role will be assumed by General Manager Infrastructure & Assets

Position Statement The CMT Director is responsible for declaring a business continuity eventand invoking the BCP.

The CMT Director is required to oversee and manage all resumptionactivities.

During a workplace emergency the Chief Warden has authority until theworkplace emergency is resolved and control is returned to the CE orCMT Director if the BCP is to be activated

Knowledge Requirements 1. High level of organisation activities and service delivery priorities

2. Community, Business and Regulatory contacts

Responsibilities The CMT Director must make decisions as to the best strategy for businessresumption based on information received by other CMT members. Thisstrategy is then translated into an action plan by the supporting teams.

Responsibilities include:

Maintain working knowledge of BCP & relevant Critical Function SubPlans

Participate in monitor and review activities

Participate in and ensure appropriate levels of training is undertaken

On Activation:

Activate the BCP

Notifying and liaising with stakeholders

Provide the focal point in communication to the staff, media and public

Establishing and chairing all CMT meetings (may delegate)

Authorisation of any detailed restoration plan

Delegate tasks and overseeing resumption activities

Monitor the gathering of business interruption event information

Promote the wellbeing and safety of all staff

Liaise with elected body via the Mayor

Date approved by CMT 25 July 2012

20

Responsibility Statement – CMT Member Engineering and Environment

Position CMT Member Staff Position General Manager Engineering andEnvironment

During absence this role will be assumed by General Manager Infrastructure & Assets

Position Statement A successful Continuity Management Team (CMT) relies on expertise fromwithin the organisation as they are the people that understand the businessprocesses and related risks. Accordingly, the Executive and Manager Teammembers are the designated members of the CMT and charged withimplementing the whole of organisation response. However they stillmaintain responsibility for the continuity and recovery actions of theirindividual business units. The business unit activities are undertaken by thefunction managers in accordance with agreed sub plans.

Knowledge Requirements 1. High level of group activities and service delivery priorities2. High level knowledge of group critical function sub plans

3. High level knowledge of overarching BCP

Responsibilities Responsibilities include:



Participate in and ensure appropriate levels of training are undertakenwith Critical Function Sub Plan Managers

On Activation:

Operate as a member of the CMT

Ascertain the impact on business unit activities and report to CMT

Co-ordination of business unit Critical Function Sub Plan implementationas required

Monitoring implementation against the Business Continuity Plan

Maintaining information and report on costs to CMT

Maintain communications with staff


21

Responsibility Statement – CMT Member IT Services

Position CMT Member Staff Position Manager IT Services

During absence this role will be assumed by ICT Infrastructure & Security Coordinator


Knowledge Requirements 1. High level of group activities and service delivery priorities2. High level knowledge of group critical function sub plans






On Activation:








22

Responsibility Statement - CMT Member Planning & Development

Position CMT Member Staff Position Manager Planning andDevelopment

During absence this role will be assumed by Manager Infrastructure


KnowledgeRequirements

1. High level of group activities and service delivery priorities2. High level knowledge of group critical function sub plans






On Activation:








23

Responsibility Statement - CMT Member Library & Customer Service

Position CMT Member Staff Position Manager Library & CustomerService

During absence this role will be assumed by Coordinator, Customer Service









On Activation:







Date approved by CMT

24

Responsibility Statement - CMT Member General Manager Organisation & Culture

Position CMT Member Staff Position General Manager Organisationand Culture

During absence this role will be assumed by Manager Human Resources









On Activation:








25

Responsibility Statement – CMT Co-ordinator

Position CMT Co-ordinator Staff Position Manager Governance and Strategy

During absence this role will be assumed by Manager, Health Environment and Community Safety

Position Statement The CMT Co-ordinator is required to assist the CMT Director in themanagement of the business resumption activities. The CMT Co-ordinatormust be familiar with the business continuity plan, Critical function Sub Plansand team responsibilities.

Knowledge Requirements 1. High level knowledge of overarching BCP

2. Understanding of organisation activities and service deliverypriorities

3. High level of internal key contacts and accountabilities

Responsibilities The CMT Co-ordinator is required to report to the CMT on the currency ofindividual and business level continuity plans and activities.

Responsibilities include:

Pre event co-ordination of BCP and Sub plans with relevant owners

Co-ordination of training for CMT & CMT SG members

Co-ordination of testing for the Business Continuity Plan

Resourcing of Control Centre

On Activation:

Open Control Centre on direction of CMT Director

Assisting CMT Director as required

Notify Insurer and manage the insurance requirements


26

Responsibility Statement – CMT Communications

Position CMTCommunications

Staff Position Communications Officer

During absence this role will be assumed by Executive Assistant

Position Statement The CMT Communications is responsible for communicating messages ofthe Control Centre (if established).

Knowledge Requirements 1. High level of knowledge of organisation communications methods

2. High level of internal key contacts and resource knowledge


Maintain working knowledge of BCP & relevant Critical Function Sub Plans

Maintain high level of communications skills

On Activation:

If required, assist with the crafting of communications messages of the ControlCentre

Assist the CMT Director and Mayor with media liaison

Distribute communications messages using key communications metholds


27

Responsibility Statement – CMT Support

Position CMT Support Staff Position Planning & DevelopmentAdministration Officer

During absence this role will be assumed by Personal Assistant, Organisation and Culture

Position Statement The CMT Support is responsible for the smooth functioning of the ControlCentre (if established) and the administrative needs of the CMT.

Knowledge Requirements 1. High level of internal key contacts and resource knowledge

2. High level of administrative functions and arrangements


Maintain working knowledge of BCP & relevant Critical Function Sub Plans

Maintain high level of administration skills

On Activation:

If required, assist with the setup of the Control Centre and arranging stationery,equipment etc.

Arrange resources to assist CMT members (if required)

Making arrangements for all CMT meetings

Provide general administrative support (including log of all events and actions,resumption status, CMT members’ movements etc.).

Create and maintain a chronological log of meetings and decisions made.


28

BCI 1 Emergency Contacts ContinuityManagement Team

CMT Position Staff Position Contact Details Alternate StaffPosition

Contact Details

CMT Director Chief ExecutiveOfficer

Ph.: 08 8555 7023

H: 08 7324 2594M: 0409 699 [email protected]

General ManagerInfrastructure andAssets

Ph.: 08 8555 7019H: 08 8554 6572M: 0438 557 [email protected]

CMT Member General ManagerEngineering andEnvironment

Ph.: 08 8555 7057

H: 08 85541878M: 0419 864 130

040 769 [email protected]

General ManagerInfrastructure andAssets


CMT Member Manager IT Services Ph.: 08 8555 7007

H: 8552 7957

M: 0407 716 [email protected]

ICT Infrastructureand SecurityCoordinator


CMT Member Manager Planning &Development

Ph.: 08 8555 7002


ManagerInfrastructure

Ph: 08 8555 7097

H: 8555 2661

M: 0439 181 163

[email protected]

CMT Member Manager Library &Customer Services

Ph.: 08 8555 7091

H: 8596 7389M: 0409 860 162

[email protected]

Coordinator,Customer Service

Ph.: 08 8555 7087

H: 0437 818 121M: 0448 032 868

[email protected]

CMT Member General ManagerOrganisation &Culture

Ph.: 08 8555 7022


Manager HumanResources

Ph.: 08 8555 7095H: n/aM: 0427 208 [email protected]

CMT Coordinator Manager Governanceand Strategy

Ph.: 08 8555 7017


Manager, Health,Environment andCommunity Safety


29

CMTCommunications



ExecutiveAssistant

Ph.: 08 8555 7044H: 8555 2955


CMT Support Planning andDevelopmentAdministration Officer

Ph.: 08 8555 7096H: 8555 4034

[email protected]

PersonalAssistant,Organisation andCulture

Ph.: 08 8555 7032H: 8555 3464


30

BCI 2 Emergency Contacts External

Service Company Contact Details

Air Conditioning Westside Services 08 8347 7712

Electricity DS&R Electrical 0417 855 4500419 848 229

Plumbing Horseshoe Bay Plumbing 0407 600 588

Police Goolwa Police Station 08 8555 2018

Security Victor Harbour Security 0405 389 814

IT Computer Site Solutions/InterstateElectrical

Information Management Steamatic 1300 783 262

31

BCI 2. Continuity Management TeamMeeting Agenda

Initial CMT Meeting

The CMT Director is to call the initial CMT meeting to obtain more detailed information from the relevantbusiness areas impacted, including:

Staff

Any associated Emergency Services issues

Building facilities

Public relations/media

Damage/security,

Salvage of building and/or IT equipment, and

Salvage of records

During the meeting information will have been gathered by the various CMT members to produce anevaluation of the incident. A formal record of the meeting to be collated by CMT Support person withparticular emphasis on items to be actioned. This record needs to be regularly reviewed and updated asadditional information comes to hand.

Other Issues for consideration include

Scheduling of site visit

Identification of affected departments

Public notification

Schedule of staff meetings

Development of initial plan for operations (short term)

Allocation of temporary work locations.

32

BCI 3 Staff Business Interruption AlertSituation

At (insert time) on (insert date) the (insert Council) experienced (insert event) which has impacted on(insert impacts). The following services have been lost (insert losses). As a consequence the ChiefExecutive Officer has declared a Business Interruption Event and has opened the Business ContinuityCoordination Centre (BCCC) to allow the Continuity Management Team to restore Council’s criticalbusiness functions.

Plan

Council is now operating in a continuity management phase with normal operations temporary varied toensure Council can continue to provide key services to our customers. The continuity management teamis reassessing the allocation of personnel which may involve reassignment of staff to new roles with theorganisation.

Administration

The continuity management team is as follows:

CMT Director

CMT Team Members

CMT Coordinator

CMT Support

A staff briefing will be conducted at (insert time) at (insert location) to discuss Councils strategy and therole you will play in restoration. Meanwhile, all staff must ensure they have access to the followingresources (insert resources) and protective clothing (insert clothing requirements)

All continuity actions must be authorised by the CMT Director.

All staff must keep a personal log of actions and requests.

Communications

The BCCC can be contacted on (insert telephone number).

The primary mode of communication within the organisation will be (insert communication method). As aresult priority will be given to the following functions (insert functions).

Council’s business telephone number has been temporarily diverted to (insert location).

CMT Director

Insert Time

Insert Date

33

BCI 4 Media Enquiry Record FormTaken by:

Issue:

Date: Time of call:

Journalist name:

Contact numbers:

Media outlet:

Deadline:

Publication date:

Question:

Taken by:

Issue:

Response by:

Position in (Insert Client Name):

Response

Date: Time:

34

BCI 5 Press ReleaseOn (insert day and date) at approximately (insert time) Council experienced a business interruption event(describe event) as a result of this event the following services are currently impaired:

Rates

Water & Sewer

Roads

Community Services.

Services that are not impacted by the business interruption include:

Libraries

Swimming pools

Meals on wheels

Etc.

Workarounds are currently being put in place in line with Council’s Business Continuity Strategy.

Council will advise the community via the media once service delivery strategies have been confirmed

Councils contact number remains (insert number) ant will be manned from (insert times) until furthernotice

Issued by

Chief ExecutiveAlexandrina CouncilTimeDate

35

BCI 6 Telephone Redirection AuthorisationNote that telephone redirection has not been setup by LGRS. Indications from Telstra are that clientswill need to provide the following information to effect a redirection on phone numbers.

Company name

ABN

Billing Address

Redirection numbers.

Only Authorised council account holders will be able to authorise effect and will need to be preauthorised.

Emergency Redirections can be obtained with the above information by calling 13 22 55 TelstraCorporate Faults.

The following may be used to confirm your requirements with Telstra:

(Date)(Council)(Address)(Town State Post Code)

The ManagerTelephone Redirections

Dear Sir/Madam

(Insert Council Name) is in the process of activating its Business Continuity Plan in response to abusiness interruption event.

This fax is to request in writing Telstra immediately redirect the current (insert council name and number)to (insert alternate site name and number).

Council will inform Telstra again in writing when a change to this arrangement is required.

If you need clarification or to speak to a Council Representative please call (insert Mobile Number of CMTmember).

Issued by

Chief ExecutiveAlexandrina CouncilTimeDate

36

BCI 7 Business Continuity CoordinationCentre Checklist

Business Continuity Coordination Centre – Council Chambers

Element Issues to be addressed Actions Required

Location of BCCC The location of the Alexandrina Council CoordinationCentre is the Council Chambers within theadministration building providing that the building is notsubject to the interruption event

Alternate Location ofBCCC

1. Goolwa Depot meeting room

Diagram of BCCC

Provisions oftelecommunicationsfacilities

Mobile phonesFixed phones x 30 (Council Chambers)

Provision of internetfacilities

Internet available via fixed computers, laptop – remoteaccess and smart phones

Emergency powerrequirements forBCCC

UPS and cashiers and switchboard (1-2 hour use)Council Administration building has auto emergencypower for selected circuitsDepot has emergency power for centre building

Review dieselstorage at GoolwadepotReview Emergencypower circuit forchambers to ensurefunctionality

Management andStaffing

See Responsibility Statements for nominated positions

CMT Director

CCMT Member

CMT Coordinator

CMT Support Officer

Security Contracted proximity access for Administration buildingand depot

Media CE, Mayor and relevant General Managers ifunavailable Communications Officer

Initial level ofactivation

Stages of OperationActivation

Meeting or conference call to consider businessinterruption event and full team on declaration

37

Business Continuity Coordination Centre – Council Chambers

Information Displays Information Board required in BCCC

Current Operations Display Board, showing all taskscurrently being carried out

Contacts Display Board Used to display importantcontact telephone and fax numbers in regular use

Resources Allocation Board Showing resourceslocation, resources committed and resources available

Staff Rosters for longer or protracted use of the BCCC

Timing Details recording of Briefing, meetings SituationReport etc.

Media Releases Copies of publicly released materials

Plans and Documents Hard and soft copies of BCP, including Critical FunctionSub Plans

Administration Stationary Equipment list to be developed by the CMTcoordinator

Extended Operations Staff Roster to be developed if protracted use of theBCCC is expected

Briefing Sessions Suitable briefing timing sessions to be identified by theCMT

1. Staff

2. Media

3. Community

4. Elected Members

Stages of OperationStand down

Stand down of the BCCC will be at the discretion of theCMT Director

A stand down of the coordination centre may be agradual phasing down over a period of time or it may beimmediate cessation of the operation

Forms CMT Coordinator to identify suitable forms to be used tocollect and record information within the BCCC

Date approved byCMT

25 July 2012

38

BCI 8 Pandemic Response InformationGuide

If a pandemic of any description was to eventuate within any local government area, it is probable thatstate level disaster plans would be activated; these plans are separate to Business Continuity Plans andhave a community response focus.

Currently it is a requirement of the National Action Plan for Human Influenza Pandemic for all localgovernment authorities to have in place a Business Continuity Plan.

The Alexandrina Council BCP model places the importance on identifying what functions are critical to thebusiness in delivering it objectives, identifying likely failure scenarios (Pandemic, loss of IT etc.) for thosecritical business functions and then developing plans to ensure the continuity of those critical functions.

A pandemic event occurring may result in the failure scenario occurring “loss of critical staff”. It is theimpact of that loss scenario that the business continuity plan is design to respond to.

National, State & Local Pandemic Planning Matrix

National Action Planfor Human Influenza Pandemic

CommonwealthGovernment

Action Plan forInfluenzaPandemic

Australian HealthManagement Plan forPandemic Influenza

State and Territoryemergency

management plans

State and Territoryinfluenza pandemic

plans(including health

plans)

CommonwealthDisaster Response

Plan

Australian VeterinaryEmergency PlanNational Response Planfor Mass CasualtyIncidents InvolvingAustralians OverseasNational Food ChainContinuity Plan –Pandemic Othernational plans

OtherCommonwealth

Plans Other State andTerritory plans

District & Localemergency

managementplans

CouncilBusinessContinuity

Plan

CouncilBusiness IT

DisasterRecovery Plan

Local Government

Commonwealth

State/Territory

National

KEY

39

Phases of Human Influenza Pandemic

Globalphase

Australianphase

Description of phase AHMPPI 2008

REC

OVE

RY

PREV

ENTI

ON

AN

D P

REP

AR

EDN

ESS

AUS 0 No circulating animal influenza subtypes inAustralia that have caused human disease

Australian phases

1

Overseas1

Animal infection overseas: the risk of humaninfection or disease is considered low

AUS 1 Animal infection in Australia: the risk of humaninfection or disease is considered low

2

Overseas2

Animal infection overseas: substantial risk ofhuman disease

AUS 2 Animal infection in Australia: substantial risk ofhuman disease

3

Overseas3

Human infection overseas with new subtype/s butno human to human spread or at most rareinstances of spread to a close contact

ALERT

AUS 3Human infection in Australia with new subtype/sbut no human to human spread or at most rareinstances of spread to a close contact

RES

PON

SE

4

Overseas4

Human infection overseas: small cluster/sconsistent with limited human to humantransmission, spread highly localised, suggestingthe virus is not well adapted to humans

DELAY

AUS 4Human infection in Australia: small cluster/sconsistent with limited human to humantransmission, spread highly localised, suggestingthe virus is not well adapted to humans

5

Overseas5

Human infection overseas: larger cluster/s buthuman to human transmission still localised,suggesting the virus is becoming increasinglybetter adapted to humans, but may not yet be fullyadapted (substantial pandemic risk)

DELAY

AUS 5

Human infection in Australia: larger cluster/s buthuman to human transmission still localised,suggesting the virus is becoming increasinglybetter adapted to humans, but may not yet be fullyadapted (substantial pandemic risk)

6

Overseas6

Pandemic overseas: increased and sustainedtransmission in general population DELAY

AUS 6a Pandemic in Australia: localised (one area ofcountry) CONTAIN

AUS 6b Pandemic in Australia: widespread SUSTAIN

AUS 6c Pandemic in Australia: subsiding CONTROL

REC

OVE

R

AUS 6d Pandemic in Australia: next wave RECOVER

RECOVERY

Source: National Action Plan April 2009

40

Recommended Actions for Australian Businesses

AusPhase

Description of phase Recommended Actions for Australian Businesses

Aus 4 Human infection inAustralia: Smallercluster(s) consistent withlimited human to humantransmission, spreadhighly localised,suggesting the virus is notwell adapted to humans

Consider implementing remote work arrangements Consider suspending all overseas/interstate travel Purchase health and safety consumables such as disinfectant,

gloves and face masks Distribute hard copies of staff contact and supplier contact list Educate staff that if they get sick and recover, they should

return to work as they will be immune to the disease. If theybelieve they are unwell, they should not go to work.

Prepare rosters that have no overlaps and include sufficienttime for disinfecting the area before the new shift arrives

Encourage staff to eat at their desks and stagger breaks toprevent groups meeting in the break rooms

Provide staff with details of the location of fever clinics,designated influenza hospitals, infection control guidelines, thehotline for influenza and other relevant information

Exercise the Business Continuity Plan examine how continuitywill be affected in an environment of high absenteeismincluding up to 50% absenteeism, when regions arequarantined, preventing staff and goods from leaving orarriving, and when schools are closed and other socialdistancing is introduced.

Plan to allow staff to work from home Plan for ways to increase social distancing in the workplace,

e.g. video conferencing Identify the conditions where all but the critical functions would

be suspended Update company succession plans in case the key staff

succumb Review insurance policies for pandemic coverage

Aus 5 Human infection inAustralia: largercluster(s) but human tohuman transmission stilllocalised, suggesting thevirus is becomingincreasingly betteradapted to humans, butmay not yet be fullyadapted

Activate remote work arrangements Implement social distancing at work Cancel all non-essential work Activate rosters that have no overlaps and include sufficient

time for disinfecting the area before the new shift arrives Maximise building ventilation Require staff to wear surgical masks, introduce cough

etiquette and other hygiene measures Undertake daily temperature checks of staff Clean phones and all touched surfaces between shifts

Aus 6a Pandemic in Australia:localised (one area ofcountry)

Maintain a register of staff who get sick but recover, as theyare immune to the disease.

Aus 6b Pandemic in Australia: Encourage immune staff to return to work

41

Widespread Maintain contact with all employees and provide situationalupdates

Aus 6c Pandemic in Australia:Subsided

When vaccine becomes available, organise for all non-immunestaff to be vaccinated as early as practical

Implement plan for the restoration of operations

Adapted from: National Security Briefing Notes May 2009

42

BCI 9 Immediate Actions GuideNotification

On first becoming aware of a possible business continuity event, the relevant local Manager is required toassess the situation and if the event is likely to exceed the agreed “MAO timeframe”, then the CMT Directorshould be notified immediately by phone and where possible, a follow-up personal briefing detailing the keyissues including;

Nature of the incident – time informed etc

Describe business elements impacted (Critical Functions)

Facility / equipment impacted

Staff

Any response actions implemented (Critical Function Sub Plan)

Any media involvement / interest

Any immediate support requirements.

Elements of the BCP (Sub Plans) can be implemented at the local level, where appropriate to address animmediate response requirement even if the event is expected to be resolved within an acceptable period.

Assessment by Director CMT

On receipt of a notification that will impactbusiness continuity the CMT Director will:

Formally note details

Conduct preliminary impactassessment (facility and technologyinfrastructure)

Notify the other members of theContinuity Management Team (CMT)

Confirm with the Mayor appropriatemedia strategies

Determine if a control centre needsto be opened.

Ensure that the Insurer has beenformally notified

Assemble & Brief CMT

Time of incident

Nature of incident

Location of incident

Staff involved

Facilities / equipment impacted

Community impact

Emergency Services involved

Initial indications of outage duration

Media involvement

Confirm responsibility statements

Declaration

The CMT Director to review the preliminary information and if considered necessary declare a BusinessContinuity Event and notify the Mayor. The CMT Director is responsible for all internal communications. Acontrol centre may also be required to be opened.

43

CMT Director

The CMT Director is to call the initial CMT meeting to obtain more detailed information from the relevant businessareas impacted, including:

• Review situation information to date & record

• Review business unit impact statements

• Review Media statements

• Ensure all CMT members understand their responsibilities

• Develop a whole of business “Business Impact Analysis

• Staff impacts

During the meeting information will have been gathered by the various CMT members to produce an evaluationof the incident. A formal record of the meeting to be collated by CMT Support person with particular emphasison items to be actioned. This record needs to be regularly reviewed and updated as additional information comesto hand.

Initial Meeting – Business Impact Assessment

CMT Member

Prior to undertaking the initial meeting each member of the CMT is to assess and document the impacts of thebusiness interruption event

At initial meeting each business unit is to report on

• Staff impacts

• Building / Facilities impacts

• Service Delivery impacts

• Media issues

• Other relevant issuesDevelopment and Implementation of Response Strategies

Response strategies will need to be developed to address the business interruption event.

Refer to Critical Function Sub Plans within the Business Continuity Plan for implementation strategies

Briefing Media/Staff/Community/Insurer

Due to the nature of the media, the timeliness of reporting in these circumstances are critical. Prompt reportingto, and liaison with CE and Mayor is in the best interests in terms of allowing for nomination of aspokesperson as well as preparation and appropriateness of response.

In a business continuity event, all communications with the media relative to the business of Council shallbe through the Director CMT or the Mayor for community impacts.

44

Critical Function

Sub Plans

45

Organisation and Culture

46

Payroll

Prepared by Manager Human Resources Date 8/9/2014

Sub Plan Owner This plan is owned by the Manager Human Resources who has overallresponsibility for this plan.

The routine management of the plan in delegated to the Payroll Officer who hasresponsibility for ensuring the accuracy and currency of the plan and advising theManager Human Resources of any changes required.

Identified Critical Business Functions

The preparation, processing & transport of council’s fortnightly payroll.

Overview of Functions (Context)

Council’s payroll is processed on a fortnightly basis with pay periods ending every second Tuesday andthe funds transferred to the bank electronically by 4pm on the Wednesday following the end of the payperiod. Payments are made to staff in accordance with Council’s Enterprise Agreements and Awardsand other relevant legislation.

Business Impact Analysis

Business Impact of FunctionLoss

Penalties for Non Delivery Functional Interdependencies

Staff do not receive pay

Staff complaint

Staff do no present to workfor industrial dispute

Staff may requestreimbursement of financialinstitution default charges

Industrial unrest

Timesheets and variations

IT platform and software.Ability to transfer data to thebank

Banking system to receiveand action data.

Current Resources Premises/Equipment/ Staff

Minimum Resources Required Alternate Manual Process orWork Around

IT access & equipment(Synergy, internet banking,emails)

1.8 Payroll officer

Payroll officer & payrollmanual

Cadell St Offices

Timesheet

1.5 Payroll Officer

Internet on Wednesday

Synergy Soft/IT Vision

Run last pay

Ask other Council’s,Yankalilla to processAlexandrina payroll or assistwith payroll.

47

Payroll

Disruption Scenario Max Allowable Outage

IT outage

Loss of staff (payroll)

Loss of utilities

Bank Failure

1 to 2 days (pay week)

5 days

4 days

2 days

Authority for Invoking Plan A standing authorisation is given to the plan owner to activate the planonce the outage exceeds that Maximum Allowable Outage as describedabove.

Key Decision Makers to be assembled

Manager Human Resources, payroll officer/s General Manager Organisation and Culture

Stakeholders other than process owner

Internal External

All employees ANZ

Pre Event Preparedness Current policies & procedures & access points required to deliver function

The current policy and procedures for this critical function can be located –

Electronic copies:

G:Drive / Payroll

Synergy Records

Hard copies:

Payroll cupboard

48

Payroll

Emergency Response Immediate actions required if function is lost.

On being advised of a business interruption event the following immediate responses should beconsidered:

The Manager Human Resources and Payroll staff to be informed immediately.

Source of Disruption to be identified where possible (i.e. internal IT system/external banking ortelecommunications infrastructure.

Identify possible downtime with key decision makers (IT, HR, finance)

Consult with stakeholders (i.e. let employees know of possible outcomes, liaise with bank, delay orvariation/standard/base pay

Implement emergency procedure

Document & review emergency process taken

Continuity Management Actions required to ensure continued availability of the function

In the event of a business interruption event occurring as identified within the disruption scenarioanalysis, that exceeds the identified MAO the following responses may be appropriate:

Consult with key decision makers on appropriate course of action i.e. when will IT access again beavailable / discuss options = bank

If deemed necessary, process standard hour pay run as per Emergency Procedure

Communicate with stakeholders

In the event of loss of staff the CMT to be informed to identify secondment or temp staff to assist inpayroll.

Communication Considerations

Internal External

Inform members of EMT

Provide all employees with up to dateinformation (may need to use alternatemethods if no emails)

Need emergency contact details if no ITavailable

Liaise with ANZ

o Local branch

o Business banking’s online

Notify applicable statutory bodies – super andchild support

Further Treatment/ Action Plans Actions required for continuous improvement

Treatment/ Action Plan Position Responsiblefor development

TargetDate

Emergency procedure to be reviewed and updated Payroll officer June 2015

49

Service Centre – Call Centre

Prepared by CS Manager Date 13.01.2016

Sub Plan Owner This plan is owned by the General Manager Organisation & Culture who hasoverall responsibility for this plan, including routine management andresponsibility for ensuring the accuracy and currency of the plan.


Call Centre


Focal point of communication between Community and Council. Becomes a critical function in times ofemergency.



Penalties for Non-Delivery Functional Independencies

Inability for Council to coordinatea response with community

Misinformation – potentiallitigation

Pressure on front office staff

Inputs required

CIS StaffSystems

IT platform and softwarePhone system , CRM, Telstra

DownstreamEnquires not reaching office

No feedback to or from CouncilOfficers

Current ResourcesPremises/Equipment/Staff


2 full time employees

Office space

Desk space

Phone stations (x3)

Cisco application

IT Network/backup

ISDN Connection

4 full time employees (increase)

Office space

Desk space

Phone stations (4)

Cisco application

IT Network/backup

ISDN Connection

Loss of Call Centre Software

Divert to Out of HoursEmergency servicesprovider

Initiaterepair/replacementwithin 24 hours

Longer than 24hours,reprogram system to useextensions in call group

50

Staff Training Staff Training Loss of System (including CallCentre)

Contact Telstra anddivert to After hours

Contact IT Serviceprovider forrepair/replace

Loss of Telstra Service

Divert to EmergencyAfter Hours contactTelstra immediately

Disruption Scenario Max Acceptable Outage

Loss of Call Centre Software Loss of System (including call centre) Loss of Telstra Service

2 Hours 2 Hours 2 Hours

Authority for Invoking Plan A standing authorisation is given to the plan owner to activate the planonce the outage exceeds the Maximum Acceptable Outage asdescribed above


General Manager, IT Manager, Manager Customer Services, Coordinator Customer Services


Internal External

Customer Service StaffAll Staff

Emergency After Hours providerTelstraIT Service provider


The current policy and procedures for this critical function can be located:

Electronic Copies G:/LCS/CustomerService

Hard copy: Copy of staff directory in phone room (updated quarterly)



Contact Emergency After Hours to act as back up

Notify CE and General Manager Organisation & Culture, Manager Customer Service, CoordinatorCustomer Service

51

Notify IT

If internal issue, Information Technology staff to advise on duration of outage. If outage is to belonger than identified MAO the continuity response to be enacted.


In the event of a business interruption event occurring as identified within the Disruption scenarioanalysis, that exceeds the identified MAO the following responses may be appropriate:

Loss of Call Centre Software

Divert to Emergency After Hours initiate repair/replacement within 2 hours Longer than 24hours

Loss of System (Including Call Centre)

Contact Telstra and divert to Emergency After Hours Contact service provider for repair/replace

Loss of Telstra Service

Divert to Emergency After Hours contact Telstra within 24 hours Arrange temporary connection from Telstra

Further Treatment/Action Plans Actions required for continuous improvement

Treatment/Action Plan PositionResponsible fordevelopment

Target Date

Reviewing existing after hours service provider Manager, CustomerService

2017

Review existing programming capacity of call centresoftware

Manager, CustomerService

2017


InternalAll staff including elected members

ExternalService providers including website.

Emergency notification message.

52

Customer Service

Prepared by Manager, Customer Service Date 13.01.2016

Sub Plan Owner This plan is owned by the General Manager Organisation and Culture who hasoverall responsibility for this plan, including routine management andresponsibility for ensuring the accuracy and currency of the plan.


Front Counter Service at two branches – Goolwa and Strathalbyn


Focal point of communication between Community and Council. Becomes a critical function in times ofemergency.




Cannot deliver payments,receipting, library, andtransactional dealings in general.

Misinformation

Pressure on front office staff

PR / reputational damage

Inputs requiredFront Counter trained operators

SystemsIT platform and softwarePhone system, Telstra

DownstreamEnquires not reaching office

No feedback from CouncilOfficers



3 full time employees 5 full time employees

Office space

Desk space

Phone station

Cisco application

IT Network/backup

ISDN Connection

Another location to becommunicatede.g. Strathalbyn or alternativevenue in Goolwa.

53

Staff Training

1 mobile

Front countertablet/desktop/laptop


No access to buildings 2 Hours



General Manager Organisation Culture, Manager Customer Service, IT Manager, Manager CustomerServices, Coordinator Customer Service


Internal External

Customer Service & Library StaffElected members

All Staff

Community


Signage ready to be deployed on main entrance (if possible, if not an officer stationed at appropriatelocation)

Procedure for response, including script for customer enquiries



Signage and communications.



As above.


Treatment/Action Plan PositionResponsible for

Target Date

54

development


InternalStaff

External

Public

55

Communications

Prepared by General ManagerOrganisation & Culture Date 05.06.2012

Sub Plan Owner This plan is owned by the General Manager Organisation & Culture who hasoverall responsibility for this plan.

The routine management of the plan in delegated to Communications Officer whohas responsibility for ensuring the accuracy and currency of the plan and advisingthe General Manager Organisation Development of any changes required.


Public relations communication and internal communications


In the event of any significant disruption to business continuity the ability of Council to communicate toits staff and its community will be essential and this communication is often undertaken by means whichmay themselves be affected by the business continuity disruption




Unable to communicate thesituation with staff

Unable to communicate thesituation including what Councilsservice strategy is at the time

TelecommunicationsServer based

Information RelayServer based intranet/internet

Mobile Technologies

Contact detailsServer based



Main server – Goolwa Office

Backup – Goolwa works depot

Contact details/address books –electronic server based & paperbased

Mobile phones

1 Full time employeecommunications officer

IT system

1x mobile phone

Verbal briefings

Notice boards – white boards,pins

Paper based – contact list

Buildings – public announcementsystem


Interruption to Information Technology services 1 – 2 hours

56

Authority for Invoking Plan A standing authorisation is given to the plan owner to activate the planonce the outage exceeds the Maximum Allowable Outage as describedabove


Communications Officer, Team Leader, Library and Customer service, Manager Information Technologyservices, General Manager Organisation & Culture


Internal External

All staff All customers



Electronic Copies

Information Technology – Disaster Recovery Plan

Hard Copies

Manual Contact list – staff, key customer groups, media etc.



Key decision makers review situation

Source of disruption to be identified where possible (i.e. internal IT system / telecommunicationsinfrastructure)

Communicate with staff/public via briefing in building, public announcement system, signs,noticeboards, mobile phones, website, social media (Tourism), newspaper social media, radio

Disruption to service that exceeds MAO – communicate in local paper, remote access to website,erect notices in the community at local businesses. Visitor Information Centre used to provideadvice/information to the community, social media (Tourism)



Information Technology Disaster Recovery Plan

57



Target Date

Prepare a manual including media contact listensuring updated ¼


31 July 2015


58

Engineering andEnvironment

59

CWMS

Prepared by General ManagerEngineering andEnvironment

Date 29.06.14

Sub Plan Owner This plan is owned by the General Manager Engineering and Environment whohas overall responsibility for this plan.

The routine management of the plan in delegated to CWMS Coordinator who hasresponsibility for ensuring the accuracy and currency of the plan and advising theGeneral Manager Engineering and Environment of any changes required.


Community Wastewater Management Schemes


Alexandrina Council has over 6000 CWMS connections, four treatment plants, 58 pump stations




Inability to release and transportsewage into the environmentincluding waterways

Public Health concern/risksincreased

Litigation

Statutory Penalties includingfines from the EPA, loss oflicence from EPA

PR Issues

Inputs requiredMaintenance Staff

SystemsIT platform and softwarePlant – Public Infrastructure



7 staff including an electrician

3 backup generators

Depots including workshops atSouth Goolwa

3 light truck service units

3 Utes

Failure of alarms on all systems

7 staff including an electrician

3 backup generators

Depots including workshops atSouth Goolwa

3 light truck service units

3 Utes

Failure of alarms on all systems

Portable Generators

Rewire control panels to enablebasic operations can continue

Install /use standby pumps

60


Power failure Flooding of Chambers Loss of staff Treatment Plant Failure

8 Hours 10 Hours 2 Weeks 4 Hours

Authority for Invoking Plan A standing authorisation is given to the CWMS Supervisor to activatethe plan once the outage exceeds the Maximum Acceptable Outage asdescribed above


CWMS Coordinator, CEMS Supervisor, Manager Engineering Services, Manager EnvironmentalHealth, GM Engineering


Internal External

Chief Executive EPA

Department of Health



Hard Copies

CWMS Maintenance – Operational Manual

Waste Water Treatment Plant Operation Manuals



• CWMS Maintenance – Operational Manual

• Waste Water Treatment Plant Operation Manuals



Risk assessment conducted by key decision makers in relation to specific nature of outage

61



Target Date

Ongoing maintenance CWMS Supervisor Bi-annual


Internal

CE

External

EPA, Department of Health

62

Waste Management


Date 29.06.2014

Sub Plan Owner This plan is owned by the General Manager Engineering and Environment whohas overall responsibility for this plan, including routine management andresponsibility for ensuring the accuracy and currency of the plan.


Waste Management – Operation of Waste transfer stations, including collection of kerbside waste.


Alexandrina Council is a member of a local Government Subsidiary “Fleurieu Regional Waste Authority”who operates Councils waste transfer facility including the collection of kerbside waste and recyclables.




An increase of waste within thecommunity

Public Health Risk

Adverse public reaction

Loss of integrity / reputation

Potential litigation Staff, plant and equipment fromother organisations.



8 Trucks and 2 back up trucks

Contract trucks can be sources ifrequired

15 staff for WTF and 9 staff forcollection trucks.

6 trucks can be used for a shorttime

Hire additional trucks

Re allocate resources / stafffrom WTF’d

Re prioritise tasks


Plant breakdown that requires other trucks to be sourced Staff unavailability that requires reallocation of tasks for Waste

Transfer Facility staff

2 Days 2 Days & ½ day for WTF

closure

63

Disposal location (landfill) closes due to unforeseencircumstances

Nil

Authority for Invoking Plan A standing authorisation is given to the Fleurieu Regional WasteAuthority (FRWA) Executive Officer to activate the plan once the outageexceeds the Maximum Acceptable Outage as described above. FRWAdoes not have its own business continuity plan.


Executive Officer – FRWA, Operations Manager - FRWA


Internal External

CE



Electronic Copies

FRWA internal systems

Hard Copies

FRWA internal systems


Notify EPA that there has been a suspension of services

Notify internally of interruption event

Ensure communication of interruption is disseminated through Councils communication channels

Initiate contact with FRWA due ascertain duration of outage


Maintain communications with FRWA to ensure contract obligations are maintained

Consider closure of waste transfer station and diversion to alternative site

Consider use of alternative contractor in the event that rubbish cannot be collected



Target Date

Liaise with FRWA to gain an understanding of theircontingencies to deal with business interruptions.

General ManagerEngineering

Jan 2015

64

Services


65

Road Services


Date 13/7/2014

Sub Plan Owner This plan is owned by the GM Engineering and Environment who has overallresponsibility for this plan.

The routine management of the plan in delegated to Manager Field Services whohas responsibility for ensuring the accuracy and currency of the plan and advisingthe General Manager Engineering and Environment of any changes required.


Road Services


Overall maintenance of Councils public roads and associated infrastructure.



Penalties for Non Delivery Functional Independencies

Inability for residents to accessareas safely

Disruption to Councilmaintenance schedule

Access for emergency services

Potential Litigation Inputs requiredStaff, Heavy Equipment,availability of raw materials,contractors

SystemsIT platform and softwarePhone



Staff

Plant

Contractors

2 staff

2 utes

Possibly grader (1) and/or otherheavy machinery depending ontype of business interruption.

Contract labour / machinery

Seek assistance fromneighbouring Councils


Inability for residents to access properties Heavy plant breakdown Disruption to Council maintenance schedule Inability for emergency services to access properties Contractors not available

1 Day 20 Days 20 Days 1 Day 1 Week.

66

Authority for Invoking Plan A standing authorisation is given to the plan owner to activate the planonce the outage exceeds the Maximum Allowable Outage as describedabove


Engineering Services Manager, Supervisors (civil and construction) and GM.


Internal External

CE General Public

Emergency Services

Contractors



Electronic Copies

Various SOP’s – Intranet

Plans

Hard Copies

Various SOP’s – Depots



Contact Engineering Services Manager, Supervisors (civil and construction) and GM.



Liaise with Engineering Services Manager, Supervisors (civil and construction) and GM.

Liaise with Communications Officer to arrange media release(s) as appropriate

Make direct contact with affected residents

67



Target Date


68

Food Safety Regulations

Prepared by Manager Health,Environment and CommunitySafety

Date 14.07.2014

Sub Plan Owner This plan is owned by the Manager Health, Environment and Community Safetywho has overall responsibility for this plan, including routine management andresponsibility for ensuring the accuracy and currency of the plan


Food Safety Regulation


Emergency situations relating to food safety i.e. outbreaks of food-borne disease.



Penalties for Non Delivery Functional Independencies

Staff do not present for work

Failure to fulfil legislativerequirements

Poor reception bymedia/community

Illness/deaths in community

Information unavailable

Ombudsman/Ministerintervention

Liability to CE

Inputs requiredAssistance to Department ofHealth

SystemsIT platform and software (Healthmodule)

DownstreamSA Health to receive relevantinformation



Access to car/transport

2 full time employee EHO’s1 full time employee EnvironmentHealth Support Officer1full time employee ManagerHealth, Environment andCommunity SafetyOffice spaceDesk spaceLaptops/terminal serverTelephonesIT system – synergy healthmoduleThermometers

2 full time employee EHO’s + 1

FTE support officer

Thermometers (3)Australian Food SafetyAssessment (AFSA) -electronically or paper version

Car / Transport

Use AFSA inspection pads andcarbon copy

Use taxis or private vehicles

69


loss of key staff Interruption to Information Technology services Loss of vehicle access (if inspections are scheduled – i.e.

prohibition order being lifted)

1 day 2 days 1 day



Manager Health, Environment and Community Safety, Environmental Health Officers, GeneralManager Environmental and Development, Environmental Health Support Officer


Internal External

EHO’s (Environmental health Officers)

EH Support Officer

Department of HealthAlexandrina CommunityBusiness implicated in outbreak



Electronic Copies

SOP’s on Connect Intranet Workspace for Environmental Health team

Hard Copies

No hard copies available or required – Department of Health is the lead agency for foodborne illnessoutbreak



Manager Health, Environment and Community Safety informed immediately

Identify if resources are adequate and second staff from other Councils if required

Ensure AFSA available and food inspection kits ready source top ups if required.

70



Use manual AFSA if required

Second extra staff EHO’s from other Councils if needed



Target Date

Ongoing dialogue with adjoining councils to supportof a reciprocal arrangement could be reached

Emergency Kits including AFSA available andstocked

Manager Health,Environment andCommunity Safety

Annual

Annual


InternalInform all staff that EHO’s are unavailable until further notice, due to emergency or direct regularenquires to an agreed point.

ExternalMedia release potentially required to highlight what is being done. Must be very careful as investigationon going

71

Environmental Health Emergency Management

Prepared by Manager Health,Environment and CommunitySafety

Date 05.06.2012

Sub Plan Owner This plan is owned by the Manager Health, Environment and Community Safetywho has overall responsibility for this plan, including routine management andresponsibility for ensuring the accuracy and currency of the plan


Environmental Health Emergency Management


Emergency Management in the event of a natural disaster where the SA Department of Health is thelead agency




Availability of Staff& Contractorsto perform all business functions

Poor perception in thecommunity

Illness / Death

Failure to meet statutoryresponsibilities / MOUagreements

Poor media perception

Inputs requiredAssistance to Department of

Health, Essential Safetyequipment including vehicles

SystemsIT platform and software



EHO’s/Manager/ EH SupportOfficerOffice spaceDesk spacePhonesIT SystemsLaptops/terminal/servicesImmunisation Contractors

EHO’s/staffTelephonesEmergency Management Kitincluding alcohol gel,information, inspection sheetsVehicleImmunisation Contractors

Use of private vehicles / taxis


loss of key staff Interruption to Information Technology services No available vehicles

1 day 1 day 1 day

72



Environmental Health Manager, General Manager, EHO’s


Internal External

Staff

Elected Members

General PublicDepartment of HealthPolice and Emergency ServicesOther Government Agencies



Electronic Copies

Intranet

Hard Copies

Fact sheets in office



Get kits and vehicle ready and await direction from Department of Health.



Ongoing dialogue to other Councils for usage of staff to assist



Target Date

Routine Check of Emergency Management Kits

Ensure EHO’s are emergency management trained –

EHO’s December 2015

73

ongoing as required. Annual


InternalInform Customer Service staff of what is occurring and how to contact EHO’s and what service level willbe during this emergency

ExternalDepartment of Health, Other Councils, Media.

74

Infrastructure & Assets

75

Information Management – Vital Records

Prepared by Team Leader InformationManagement Date 26/08/2014

Sub Plan Owner This plan is owned by the General Manager Infrastructure & Assets who hasoverall responsibility for this plan, including routine management and responsibilityfor ensuring the accuracy and currency of the plan


Information Management


Manage life cycle of documents for council, manage information and to meet legislative requirements(e.g. FOI)




Cannot meet legislativerequirements

Cannot access information forCouncil operations

Legislative provisions for fines Inputs requiredIT system

Hard copy storage



1 Co-ord

3 FTE

Local Govt Software

Scanners (3)

7 computers

Onsite

1 bunker

1 container (depot)

Offsite (contracted)

4 staff (FTE)

3 Computers

1 Scanner

Secure onsite storage

1 bunker

1 container (depot)

Offsite (contracted)

Incoming mail

Building plans

Excel recording

Access to photocopier orscanner

76


IT LossLoss of records (fire)No access to Principal OfficeNo access to bunkerNo access to temporary storage providerLoss of 1 or more key staff

1 Day Immediate 2 Days 2 Days 2 Days 1 Week

Authority for Invoking Plan Plan Owner


CE, 3 GM’s, Manager IT Services, Coordinator Information Management


Internal External

All staff

Elected members

State Records

Affected stakeholders


All of council and internal team policies & procedures

State Records audits



Identify issue

Understand timeframes

Develop plan for situation - schematic



Source alternative premises (Strathalbyn or work from home) to deal with IT flow

Site must have bare minimum resources

77



Target Date

Development of Vital Records Plan (in Draft) Aug 2015


InternalAll staff

Elected Members

ExternalApplicable members of public

Legislated stakeholders

78

IT Services – Service Desk

Prepared by Manager IT Service Date 26.08.2012

Sub Plan Owner This plan is owned by the Manager IT Services who has overall responsibility forthis plan, including routine management and responsibility for ensuring theaccuracy and currency of the plan.


Service Desk Internal / IT Advisory including contracted services.


Council’s service desk provides support to internal staff in the operation of IT systems and equipment.




Inability for staff to conduct theirduties impacting on Counciloperations

Staff complaint

Breach of contract (IT Advisory) SystemsIT platform and software



2 full time employee service deskofficer

One office space

Desk space

IT Systems

Telephone

3 full time employee (internal)

IT system

Telephone (1 mobile)

Infrastructure team to fill in

Third party contractor maybeengaged

Extend service time frames

Divert phone


Loss of Service Desk 4 hours



79

Manager IT Services, Service Desk Coordinator


Internal External

Staff

Elected Members

Partner Organisations (KI and Fleurieu Regional waste)

Contractors

Public



Electronic Copies

1:\procedures





Third party contractors to be engaged



Target Date

Ongoing maintenance of DRP IT Mgr Aug 2015


InternalLink to communications plan ensuring staff including elected membersExternalLink to communication plan to advise Partner Organisations, public

80

IT Services Infrastructure

Prepared by Manager IT Services Date 26.08.2014

Sub Plan Owner This plan is owned by the Manger IT Services who have overall responsibility forthis plan, including routine management and responsibility for ensuring theaccuracy and currency of the plan.


IT Infrastructure / IT Advisory including contracted services


The IT Infrastructure provides the underlying communication and business systems for Council.




Inability for staff to perform corebusiness

Inability for core functions to beundertaken

Breach of contract

Breach of legislativerequirements

SystemsIT Infrastructure and software,Utilities, power, comms, air-conditioning



2 full time employeesInfrastructure Staff

Office space

Data centre space

IT Infrastructure

Telephone

Utilities

2 full time employeesInfrastructure staff

Data centre space

IT Infrastructure

Utilities

Engage third party


Denial of access to the site loss of key staff (Infrastructure and Security Coordinator) loss of key staff (network systems admin) Interruption to Information Technology services

14 Days 1-2 Days 14 Days 12 Hours

81



Manager IT Services, Infrastructure and Security Coordinator, General Manager Corporate andCommunity Services


Internal External

StaffEM’s

Partner OrganisationsContractorsPublic



Electronic Copies

Password Manager I:\Passwords

Procedures I:\Procedures



Source of disruption to be identified where possible (i.e. internal IT system / telecommunicationsinfrastructure)

Determine duration

If outage is to be longer than identified MAO the continuity response to be enacted.



Restore some backups to external location provided by a third party



Target Date

82

Review IT Infrastructure DRP Manager IT Services Aug 2015


InternalLink to Communication Plan to critical function plan including advising staff and elected member

ExternalLink to communication plan to advise partner organisation and public

1